The framework
The United Arab Emirates has enacted Federal Decree-Law No. 45/2021 (PDPL), but the regime is not yet fully operative.
For advertisers the consent posture matters most, and the United Arab Emirates sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Federal Decree-Law No. 45/2021 (PDPL); DIFC and ADGM run separate GDPR-style regimes
The UAE's federal PDPL was issued in 2021 but its executive regulations have still not landed as of mid-2026, leaving enforcement effectively paused at the federal level. In practice the DIFC Data Protection Law 2020 and ADGM regulations, both GDPR-grade and actively enforced, plus sectoral health and telecom rules, are what companies actually comply with.
Marketing and advertising
Consent-centric federal law on paper, but its executive regulations remain unissued, so operative obligations today come mainly from the DIFC and ADGM regimes and sectoral rules. Most channel decisions here follow from that consent rule.
Cross-border transfers
Federal law contemplates adequacy and safeguards pending regulations; DIFC and ADGM apply GDPR-style transfer tools with their own adequacy lists.
Enforcement and penalties
To be set by the pending executive regulations; DIFC fines have already reached six figures.